Nullable text columns on federation_peers and peer_approval_requests. Existing rows degrade gracefully (NULL token) per spec §5; the verification logic landing in subsequent commits routes legacy null-token state through the existing autoAccept gate.